The enquiries you never received are the European ones

---

QUICK ANSWER

Most website contact forms send their notification email pretending to come from the visitor who filled it in. Mail systems have checked for exactly that since 2014, and a check of twenty nine consumer mail providers found twenty two now quarantine or reject it. Every French provider tested enforces. So do the German and British ones. Gmail does not, which is why the Gmail enquiries arrive, nothing looks broken, and the European ones quietly disappear. The fix is a configuration change and costs nothing.

---

A hotel in Girne rebuilt its website, added a booking enquiry form, and got almost nothing for a season. The form worked. Filling it in produced a thank you page. Testing it from the owner's own phone produced an email.

Nothing about that test told the truth, because the owner's phone used a Gmail address.

This is one of the few website problems that hides itself perfectly. It fails only for some senders, it fails silently, and the ones it fails for are the customers worth the most.

Your form probably sends mail pretending to be the visitor

Here is the mechanism, and it is worth understanding because the fix follows directly from it.

When somebody fills in your form, your website sends you an email. Almost every form builder ever written sets the From: line of that email to the visitor's own address, so that replying goes to them. It is a sensible looking convenience and it has been the default for twenty years.

But your server is not their mail provider. An email leaving your hosting company claiming to be from [email protected] is, as far as the receiving system can tell, a forgery. That is precisely what a forgery looks like, because it is how phishing works.

Mail systems started checking for this properly after Yahoo published a strict policy in April 2014. The check is called DMARC, and it asks a simple question: does the domain in the From: line vouch for the server that sent this? When your website sends as [email protected], the answer is no, and what happens next is decided by whatever orange.fr has published.

Twenty two of twenty nine mail providers now quarantine or reject that

This is checkable in seconds, and the result decides everything, so here it is measured rather than asserted. Every consumer mail provider a European guest is likely to use, queried on 6 September 2026:

Publishing reject, meaning the message is refused outright: yahoo.com, yahoo.co.uk, aol.com, laposte.net, sfr.fr, btinternet.com, sky.com, mail.ru, zoho.com.

Publishing quarantine, meaning it goes to the spam folder: orange.fr, free.fr, wanadoo.fr, web.de, gmx.de, gmx.net, icloud.com, me.com, libero.it, virgilio.it, protonmail.com, proton.me, googlemail.com.

Publishing none, meaning no action requested: gmail.com, outlook.com, hotmail.com, hotmail.co.uk, live.com, t-online.de, yandex.com.

Twenty two of twenty nine ask for enforcement. Every French provider on the list does. Three of the four British ones do. Three of the four German ones do.

Gmail is among the seven that do not, which is exactly why nobody notices

Read that last group again, because it explains the whole shape of the problem.

The providers requesting no action are Gmail, Outlook, Hotmail and Live. Those are the addresses your staff test with. Those are the addresses your friends use. Those are the enquiries that arrive.

So the form appears to work. It does work, for a large share of people. What it does not do is deliver the enquiry from a couple in Lyon on orange.fr, or a family in Hamburg on web.de, or a returning British guest on btinternet.com. Those are exactly the bookings a hotel here is trying to win.

Nobody reports a message they never knew they sent. The visitor saw a thank you page. From their side the enquiry was made.

The fix is one line in the form's configuration and it costs nothing

The correction is genuinely small, and any competent person who can log into your site can do it today.

The email your form sends should come from an address at your own domain, which your server is entitled to send as. The visitor's address goes in the Reply-To line instead. Pressing reply still writes back to the guest, exactly as before. Nothing about the experience changes, and the forgery disappears because there is no longer a forgery.

Every mainstream form tool supports this. It is usually a single field labelled something like sender address, and it is usually filled in wrong by default.

If you take one thing from this, take that. Go and look at what your form puts in the From: field. It is free, it takes ten minutes, and it is the whole of the problem for most sites.

Your outgoing mail is a different question, and here the island does better than expected

The other half of this is the mail you send deliberately: the confirmations, the quotes, the replies. That depends on records published under your own domain, and it is where most articles on this subject start predicting disaster.

So it seemed worth counting rather than guessing. Forty four hotel websites in North Cyprus were checked on 6 September 2026, drawn from the Cyprus Turkish Hotels Association membership and verified as northern property by property. Thirty eight of them receive mail at their own domain at all. The other six do not, which means the hotel's public contact address lives on somebody else's service.

Of those thirty eight, thirty six publish an SPF record. That is ninety five percent.

Google's published requirements for all senders, in force since 1 February 2024, ask for SPF or DKIM, not both, with the stricter three way requirement reserved for anyone sending five thousand or more messages a day to Gmail. No hotel on this island is sending five thousand messages a day. Against the bar that actually applies to them, almost every one of these hotels already clears it.

That is worth saying plainly, because the opposite is usually implied in order to sell something. The outgoing mail is mostly fine.

Half of them publish no DMARC, and that is a different risk from delivery

Where the census does find a gap, it is not about whether your mail arrives.

Nineteen of the thirty eight publish a DMARC record. Nineteen publish none at all. And of the nineteen that do, ten set the policy to none, which requests no action and exists to collect reports.

Publishing none still satisfies what Google and Yahoo ask of an ordinary sender, so this is not a delivery problem. It is a different one. A domain with no enforcing DMARC policy is a domain anyone can send mail as. That matters for a hotel specifically, because the message worth forging is a booking confirmation with payment instructions in it, sent to a guest who is expecting exactly that email.

Our own domain sits in this group as it goes out, at p=none, and it is being fixed rather than quietly omitted from the count.

Nobody has measured this for businesses here before. There is no published study of mail authentication for Cyprus in either jurisdiction, north or south, and none for small tourism businesses anywhere. The numbers above are ours.

What to check this afternoon, and where it stops being free

Three things, in order, and the first two cost nothing.

Read what your contact form puts in the From: field, and if it is the visitor's address, change it to yours and move theirs to Reply-To. Then send yourself a test enquiry from an address that is not Gmail. Borrow a phone on orange.fr, web.de, yahoo.com, anything on the enforcing list. That single test is the one nobody runs, and it is the only test that would have caught this.

Then look at whether your domain publishes SPF and DMARC at all. If you have no DMARC record, adding one at p=none costs nothing and tells you who is sending mail as you.

Here is the ceiling. All of that assumes you can log into the DNS for your domain, that you know which form tool the site uses, and that somebody can change a setting inside it. For a large share of businesses here, none of those three is true, and finding out is the actual work. It is also common to discover that the form has been quietly failing for a year and the enquiries are simply gone, unrecoverable, with no log of them anywhere.

What we do about it is narrow and finishable: establish where your mail actually originates, fix the sender configuration so the forgery stops, publish the records your domain should have, and then test it deliberately from a provider that enforces rather than from the Gmail account that never would have shown you the problem.

If you run the free checks and everything is already correct, you have lost an afternoon and you owe nobody anything. Based on the count above, a fair number of hotels here will land exactly there.